Lately, "John Doe" has been a popular defendant in courtrooms across the country. He's named in a growing number of suits filed against anonymous online message-board posters accused of everything from slander and defamation to misappropriation of trade secrets and Securities & Exchange Commission violations.
Of course, the first order of business in such suits is to locate the posters and convert the "John Does" into real names belonging to real people -- who are learning the hard way that anonymity online doesn't translate to identity-protection offline.
In the latest such case, Gary Dale Hoke was tracked down and arrested last Thursday after allegedly posting a fabricated story that his employer, PairGain Technologies, was being acquired by an Israeli high-tech firm. The "news," posted on a Web page hosted by Angelfire, had the look of a Bloomberg News story and was hyped on Yahoo message boards -- leading to a dramatic rise in the company's stock price.
Hoke registered for Yahoo and Angelfire under an assumed name, according to reports of the complaint against him. Investigators apparently traced him through his computers' Internet protocol addresses, which Lycos (the owner of Angelfire) and Yahoo disclosed under court order.
A rash of similar subpoenas has been served on message-board hosts of late.
And most of the companies routinely respond by handing over whatever data a judge thinks might help identify the accused.
To date, the vast majority of these subpoenas have gone unchallenged. That means that well before posters are found guilty of any misbehavior, and often before they even know that their identity is being sought, they lose their anonymity through a judge's order.
"The company could [contest the subpoenas]," says Yahoo spokeswoman Diane Hunt, "but it's not really the business we're in." And, as any lawyer will tell you, it's expensive to challenge subpoenas, especially when they're arriving by the dozen.
"Half the world is subpoenaing Yahoo," says an attorney who has been involved in similar cases. "They have a program of complying" with such subpoenas -- which makes it easier for plaintiffs to track down personal information. The company won't disclose the number of subpoenas it has received, but the half-dozen cases that have made it into the news recently -- including suits by Raytheon, Shoney's and Wade Cooke Financial -- indicate a steady flow.
At Lycos, too, subpoenas arrive on "pretty close to a regular basis," says spokesman Brian Payea. Ditto for America Online. And at Go2Net Inc., which owns Silicon Investor, a "busy month" means as many as 20 subpoenas from the SEC and another half as many from civil suits involving postings to Silicon Investor, says general counsel Ethan Caldwell.
Almost uniformly, these message-board hosting companies post privacy policies stating that they won't share any information about members -- unless compelled to do so by law. But once served with a valid subpoena, many have no standard procedures to represent the interests of the anonymous poster -- nor does the law require such policies.
Some companies notify users so that they can contest the subpoena; others simply open up their files and hand over whatever information they have. AOL gives defendants in a civil case 14 days to contest a subpoena, but doesn't notify defendants if it's a criminal case. And Go2Net tries to notify its clients "but often the time frame [for responding to the subpoena] is too short," says Caldwell.
With no laws requiring that the defendants be alerted, posters' fates are dependent on the philosophy of the company that runs the message board -- and their own financial resources and location. Hiring an attorney and flying across the country with a couple of days' notice to beat the subpoena date is not an easy task for most posters. In any case, walking into the courtroom to try to quash a subpoena would go a long way toward revealing your identity.
"There is no apparent procedural protection when someone's anonymity is being attacked," says David Sobel, general counsel for the Electronic Privacy Information Center.
"Where is John Doe in these courtrooms?" he asks. "The company's position is, 'We're on the sidelines here, if we're ordered to disclose we'll disclose.' So who is coming before the judge to present the interest of anyone other than Raytheon?" Sobel is referring to the defense contractor's pending case against 21 John Does who posted company information that Raytheon claimed was proprietary.
The posts in question made claims, some untrue, about new contracts Raytheon had won, charges it would take in its next financial report, quarterly performance and other company news. But in the Raytheon suit, filed in February in a Massachusetts court, the company alleged that the posts were
damaging and charged the John Does with breach of employee contracts and misappropriation of trade secrets.
After subpoenaing Yahoo and recovering the information leading to the
Internet service providers used by the posters, Raytheon sought and won
another court order to depose the ISPs -- Microsoft, AOL and EarthLink. Not all 21 have been identified to
date, but news reports indicate that two employees have left Raytheon in
the wake of being identified. Raytheon won't confirm the departures, but
spokeswoman Toni Simonetti said employees identified in the
case may face disciplinary actions. She emphasized that the company "is not
trying to put a chill on the free expression of our employees" but is
protecting its proprietary information. And she denied a recent report in
the Boston Globe that the information in the allegedly damaging posts was already public knowledge.
Raytheon says its suit is pending, as it continues to identify
defendants. In the past, most companies in its situation have not gone ahead and filed charges once they've obtained the names they want. Neither EPIC's Sobel, nor Shari Steele, director of legal services at the Electronic Frontier Foundation, knows of any cases in which charges have been filed once the identities of online posters have been exposed.
"I think this new use of subpoenas is really to determine identity," rather
than to bring formal charges, says Steele. "If we are going to claim that
identity is protected under the First Amendment, we need to examine this," she argues, and come up with some process that shields people's identities -- at least until there is justification to believe they have committed a crime.
"Today," says Steele, "it seems to be enough to make much lesser claims to
get someone's identity."
Message-board hosts, especially those who run boards for investors, say they have little incentive to resist efforts to identify members accused of misbehaving. "Anything that improves the legitimacy" of the communications taking place on Silicon Investor is a priority, says Go2Net spokesman Mark Peterson. AOL, too, says spokesman Rich D'Amato, has "a policy of cooperation with law enforcement," which is in line with the company's overall goal of "developing a medium we can be proud of."
But such policies -- designed to put a quick stop to destructive hackers or stock-manipulating message posters -- also encourage the unmasking of anonymous posters without any due process.
"We need to come up with ways to distinguish between someone who is hiding
behind their anonymity to commit a crime, and someone who is using anonymity
for whistle-blowing purposes or to communicate anonymously in an HIV-support
group or on a message board for battered women," says Sobel.
Steele argues that new legislation may be the best answer to this problem. But EFF isn't actively lobbying for a law right now, and no one else
seems to be pursuing it, either.
Do posters have any right to anonymity? To answer that question, someone may have to contest a subpoena that would reveal his or her identity -- leading to a legal review of this practice, and perhaps the establishment of some standard procedures to give online posters a shot at protecting their anonymity.
Until that day, "if we are served with a valid subpoena," says Yahoo's
Hunt, "we will comply. The terms and conditions [for using
Yahoo's message boards] are pretty much common sense."
Because they are subscription-based services, both Go2Net and AOL have
easy access to member billing information, and can simply hand over names
and addresses in response to subpoenas. Yahoo, Lycos and other free sites
have only the information that a member provides, which is often no more
than a free e-mail address, which itself may lead back to nothing more than
assumed names and false addresses. But more savvy subpoena-writers are
requesting IP numbers and other technical information; using that, they can trace the poster back to his Internet service provider, who can often identify the user.
So far, these approaches are helping authorities apprehend suspected criminals. But the subpoenaing of quick-trace information could also be wreaking havoc with the Internet's traditions of whistle-blowing and griping about employers, companies and institutions.
"These cases are creating an environment in which large companies can scare critics into silence," says EPIC's Sobel. "I can't help but assume -- and I think this is the intention of these cases -- that these suits are going to have
a chilling effect on people's willingness to post critical information."
Shares